ADVISORIES

• CVE-2017-0901 (NVD)
• GHSA-pm9x-4392-2c2p
• Vendor Advisory

GEM

rubygems-update

LIBRARY

RubyGems

SEVERITY

CVSS v3.x: 7.5 (High)

CVSS v2.0: 6.4 (Medium)

PATCHED VERSIONS

• >= 2.4.5.3
• >= 2.5.2.1
• >= 2.6.13

DESCRIPTION

RubyGems version 2.6.12 and earlier fails to validate specification names, allowing a maliciously crafted gem to potentially overwrite any file on the filesystem.